Hi! Ciao Halil hope all ok on your side and better than me!
The security reported bug, is about a thing that i looked to so many times.
Explain:
The field User URL on profile can contain the character ‘ (single quote) that’s allowed into an URL.
You can test it using google and searching for example: Halil’s restaurant.
Example: https://www.google.com/search?q=Halil’s+restaurant
And you can set it as user URL into the profile.
The problem:
even if the subsequent query was concatenating correctly var values, using quotes.
The problem was starting here, into the file class.wp.w3all-phpbb.php on public static function phpbb_update_profile($user_id, $old_user_data) {
$user_updated_url = (! filter_var(trim($_SERVER["REMOTE_ADDR"]), FILTER_VALIDATE_IP)) ? '' : $_SERVER["REMOTE_ADDR"];
The after, when this value were concatenated, it, even if wrapped into quotes
$w3all_phpbb_connection->query("INSERT INTO ".$w3all_config["table_prefix"]."profile_fields_data ".$qtf."
VALUES ".$qtv." ON DUPLICATE KEY UPDATE pf_phpbb_website = '$user_updated_url'");
could had lead to an SQL injection. They was able to now the database name for example.
The fix was simply to apply esc_sql without rewriting the query using standard WordPress coding practices
$u_url = esc_sql($wpu->user_url);
We will go to rewrite all from scratch very soon! Hope you’ll be there to test and help.
To moderators: ehy! you are really moderating my posts before to publish!? You really knows what you are doing?
